Skip to content

ci: add Dependabot,MegaLinter workflows #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Wan-ZL wants to merge 3 commits into
base: main
Choose a base branch
from
Open

ci: add Dependabot,MegaLinter workflows #56

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7639a11
ci: add Dependabot,MegaLinter workflows
Wan-ZL Feb 20, 2026
11f1c8e
fix: add permissions blocks and upgrade MegaLinter to v9
Wan-ZL Feb 20, 2026
a2ccb9a
chore: remove Dependabot config, migrating to Renovate
Wan-ZL Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/mega-linter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
---
# MegaLinter GitHub Action configuration
# https://megalinter.io
name: MegaLinter

on:
push:
branches: [main, master, dev, staging]
pull_request:
branches: [main, master, dev, staging]

concurrency:
group: ${{ github.ref }}-${{ github.workflow }}
cancel-in-progress: true

permissions: read-all

jobs:
megalinter:
name: MegaLinter
runs-on: ubuntu-latest
permissions:
contents: read
issues: write
pull-requests: write
steps:
- name: Checkout Code
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: MegaLinter
id: ml
# python will be replaced by the script
uses: oxsecurity/megalinter/flavors/python@v9
env:
VALIDATE_ALL_CODEBASE: false
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Disable linters that are too noisy for most projects
DISABLE_LINTERS: SPELL_CSPELL,COPYPASTE_JSCPD,REPOSITORY_TRIVY,REPOSITORY_CHECKOV,REPOSITORY_GRYPE

- name: Archive lint reports
if: success() || failure()
uses: actions/upload-artifact@v4
with:
name: MegaLinter-reports
path: |
megalinter-reports
Comment on lines +27 to +48
Copy link

@coderabbitai coderabbitai bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

git ls-files .github/workflows/

Repository: Wan-ZL/Genesis

Length of output: 149

🏁 Script executed:

cat -n .github/workflows/mega-linter.yml | sed -n '20,50p'

Repository: Wan-ZL/Genesis

Length of output: 1143

🏁 Script executed:

rg -n --glob '.github/workflows/*.yml' 'uses:' .github/workflows

Repository: Wan-ZL/Genesis

Length of output: 988

🌐 Web query:

GitHub Actions security best practices pinning commit SHA

💡 Result:

Why pin GitHub Actions to a full commit SHA?

  • Tags like @v1 can move (intentionally or after a compromise). Pinning to a full-length commit SHA is the most reliable way to make the referenced action immutable. [1][2]
  • GitHub explicitly recommends SHA pinning for supply-chain risk reduction. [1][2]

How to pin (recommended pattern)

Use the commit SHA in uses: and keep the human-friendly version in a comment:

- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

This makes the workflow reproducible while still documenting what release you intended. [2][1]

Best practices when choosing the SHA

  • Prefer the SHA that corresponds to an upstream tagged release, not an arbitrary commit on main, and verify it’s from the official repo (not a fork). [2][1]
  • If you choose to use a tag, do so only when you trust the publisher—tags are still mutable. [2]

Keep SHA-pinned actions up to date (so you don’t get stuck)

  • Enable Dependabot version updates for GitHub Actions so it can propose PRs that bump the pinned SHA to newer releases. [1]

Enforce SHA pinning centrally (org/enterprise)

  • GitHub Actions policies can enforce “must be pinned to full SHA” so non-compliant workflows fail. This is available via the Allowed actions and reusable workflows policy settings. [1][3]

Don’t stop at uses:: watch for “mutable dependencies”

Even if you pin an action, it can still be risky if it pulls mutable code at runtime (e.g., unpinned container images or downloading scripts without verification). Review/avoid actions with these patterns. [1]

Sources: GitHub Docs on security hardening for GitHub Actions (pin to full-length SHA) [2], GitHub Well-Architected Actions security guidance [1], GitHub Changelog on SHA-pinning enforcement in Actions policy [3].

Pin GitHub Actions to commit SHAs to harden supply-chain security.

Using mutable tags (e.g., @v4, @v8) can introduce unreviewed changes. GitHub recommends pinning to full commit SHAs; keep the version tag in a comment for readability.

🔒 Suggested update pattern 
-      - name: Checkout Code
-        uses: actions/checkout@v4
+      - name: Checkout Code
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

-        uses: oxsecurity/megalinter/flavors/python@v8
+        uses: oxsecurity/megalinter/flavors/python@<commit-sha> # v8

-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65462800fd760344d8b47d953a5c9c86b5ff47cf # v4

Verify the commit SHA matches the intended release tag in the upstream repository before pinning.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/mega-linter.yml around lines 26 - 47, Replace mutable
action tags with pinned commit SHAs for the three usages: change
"actions/checkout@v4", "oxsecurity/megalinter/flavors/python@v8", and
"actions/upload-artifact@v4" to their corresponding full commit SHAs (while
optionally keeping the `@vX` tag in a trailing comment for readability). Update
the uses entries for those three actions (checkout, MegaLinter flavor,
upload-artifact) to the full commit SHA strings, and verify each SHA matches the
intended upstream release before committing.

retention-days: 7
Loading